The WPJAM Basic plugin for WordPress is vulnerable to a SQL injection that can be triggered by malformed input sent to certain subscriber endpoints. An attacker who can send crafted requests to the vulnerable plugin may be able to run arbitrary SQL statements against the underlying database. This can result in disclosure, alteration, or deletion of sensitive data stored in the site, and potentially allow further escalation to compromise the hosting environment.

WordPress sites that use the WPJAM Basic plugin version 7.0.1 or earlier. The plugin is distributed by the vendor denishua and is installed as a standard WordPress plugin component.

The CVSS score of 9.3 indicates a high severity with a wide impact scope. While the EPSS score is not available, the lack of a CISA KEV listing suggests that there are currently no known public exploits, but the high base score remains a significant risk. The likely attack vector is remote, as the vulnerable functionality is exposed to web traffic and does not require authentication according to the available documentation. All users, including unauthenticated visitors, may be able to trigger the flaw if the plugin’s subscriber interface is publicly reachable.